EU AML Regulation (AMLR) for crypto-asset service providers | Customer Due Diligence Guide

What the EU AMLR and AMLA's final draft standards mean for CASP onboarding from 10 July 2027.

From 10 July 2027, crypto-asset service providers (CASPs) apply the EU Anti-Money Laundering Regulation (AMLR) directly. A CASP must apply customer due diligence to every business relationship and to occasional transactions from EUR 1,000, and at least identify and verify the customer below that amount. Under AMLA's final draft standards, remote verification is expected to use suitable eIDs, including the EU Digital Identity Wallet (EUDI Wallet), or relevant qualified trust services wherever possible.

Written by Aleksander Wasiak (Compliance Officer) and Daniel Heffernan (Crypto Market Lead), Authologic.

Title card reading "AMLR for CASPs" with the line "Customer Due Diligence Guide"

Key takeaways

The AMLR applies from 10 July 2027, and CASPs are obliged entities under it.
Customer due diligence measures apply to occasional transactions of EUR 1,000 or more; below EUR 1,000 the CASP must at least identify and verify the customer (Article 19(3) AMLR).
Under AMLA's final draft standards, CASPs providing specified crypto-asset exchange or transfer services must at least take a one-month period into account when assessing whether transactions are linked.
In Authologic's conversations with CASPs, the constraint on eID-first onboarding is usually engineering capacity rather than budget, which pushes the work into the first half of 2027.
Under the draft CDD RTS, remote verification is expected to use suitable eIDs, including the EUDI Wallet, or relevant qualified trust services wherever possible; alternative remote document checks are subject to conditions and must be justified.

Does the AMLR apply to crypto-asset service providers?

Crypto-asset service providers, as defined in the Markets in Crypto-Assets Regulation (MiCA), are obliged entities under the AMLR when providing covered services.

Advice on crypto-assets alone is excluded from the AMLR definition.

The AMLR applies directly in all Member States from 10 July 2027. Until then, their AML obligations derive from Directive (EU) 2015/849, as amended, applicable national law and the directly applicable Regulation (EU) 2023/1113 (the Travel Rule).

How MiCA, DORA, payment rules and AML rules combine for a CASP is explained in Which rules govern CASP authentication and KYC?

When must a CASP apply customer due diligence?

A CASP applies customer due diligence when it establishes a business relationship (Article 19(1)(a) AMLR) and when it carries out an occasional transaction of EUR 1,000 or more, whether in a single operation or through linked transactions (Article 19(3)(a) AMLR).

For occasional transactions below EUR 1,000, the CASP must at least identify the customer and verify the customer's identity (Article 19(3)(b)).

The general threshold for occasional transactions is EUR 10,000, subject to sector-specific exceptions. Other CDD triggers, including suspected money laundering or terrorist financing, apply regardless of value.

Situation	What the CASP must do	Legal basis
Establishing a business relationship	Apply customer due diligence	Article 19(1)(a) AMLR
Occasional transaction of EUR 1,000 or more, single or linked	Apply customer due diligence	Article 19(3)(a) AMLR
Occasional transaction below EUR 1,000	At least identify the customer and verify the customer's identity	Article 19(3)(b) AMLR
Suspected money laundering or terrorist financing	Apply customer due diligence, regardless of value	Article 19 AMLR

What counts as a linked transaction for a CASP?

On 1 October 2026, AMLA submitted to the European Commission final draft standards on criteria for business relationships, occasional and linked transactions, under Article 19(9) of the AMLR.

Under the draft, CASPs that exchange crypto-assets for funds or for other crypto-assets, or provide transfer services for crypto-assets, must at least consider a period of 1 month when assessing whether transactions are linked.

This is a criterion, not an automatic finding that transactions are linked. The draft does not set a threshold lower than EUR 1,000 for crypto-asset services. The Commission may still amend the text.

What do AMLA's draft CDD standards change in remote identification?

Under the draft CDD RTS, obliged entities are expected to verify customers remotely using electronic identification at assurance level substantial or high, including the EUDI Wallet, or relevant qualified trust services under eIDAS, wherever possible.

The draft allows alternative solutions where a natural person cannot reasonably be expected to present an identity document in person and has access to neither qualifying electronic identification means nor relevant qualified trust services. Such solutions must use reliable and independent sources and meet prescribed safeguards. Copies must be retained, time-stamped and stored securely, and the CASP must be able to justify why the customer could not be verified with the primary methods.

AMLA submitted the draft CDD RTS to the European Commission on 1 October 2026.

If adopted in their current form, the standards would apply 6 months after entering into force. What the draft changes for all obliged entities is explained in How to verify customers remotely under AMLR.

Where do eIDs and the EUDI Wallet fit for a CASP?

Article 22(6) of the AMLR recognises electronic identification means at assurance level substantial or high, as well as relevant qualified trust services, as routes to verify a customer's identity. The EUDI Wallet is one such means. Assurance levels are explained in What is a level of assurance under eIDAS?

For a CASP, a qualifying eID or EUDI Wallet can verify identity during onboarding and for transactions below EUR 1,000, but it does not complete full CDD by itself. Article 22(1) of the AMLR also requires the customer's usual place of residence or, where there is no fixed residential address with legitimate residence in the Union, a postal address at which the customer can be reached; where an eID does not return the required address, it has to come from another source, as How do you choose identity verification methods for each country? explains.

From 24 December 2027, private relying parties, except micro and small enterprises, must accept the EUDI Wallet at the user's voluntary request where strong user authentication for online identification is required by law or contract.

Whether this applies to a given CASP depends on its services and contracts.

The EUDI Wallet does not replace sanctions and PEP screening, beneficial ownership checks or transaction monitoring.

What do CASPs ask about AMLR onboarding?

Most CASPs that Daniel Heffernan, Crypto Market Lead at Authologic, speaks to already run a document and selfie flow.

Their first question is what the AMLR and AMLA's draft standards require of that flow.

The second is whether they can keep their current provider. Most plan to keep it as the fallback and put qualifying eIDs, and the EUDI Wallet as it launches, in front of it.

What CASPs want from that change depends on the platform. At volume, the aim is to reduce friction at the document and selfie step. Across markets, it is coverage: customers expect the national eID they already use, which a document-based provider often does not offer.

For CASPs, the constraint is usually engineering capacity rather than budget.

Newly licensed CASPs are focused on going live, and established ones on expanding into new markets, which pushes this work into the first half of 2027, the last few months before the AMLR applies. Firms still applying for a licence can avoid that squeeze by building eID-first onboarding in from the start.

Planning now matters because in 2027 many platforms face two sets of rules: the AMLR from 10 July and, where strong user authentication is required by law or contract, EUDI Wallet acceptance from 24 December.

Daniel Heffernan's advice: map your customers by country, check which qualifying eIDs you can use in each, and add them to your current flow in one change, rather than rebuilding it once for the AMLR and again for EUDI Wallet acceptance.

Identity questions in crypto also reach beyond customers.

On 29 October 2026, about USD 6.3 billion in crypto-assets was stolen from Binance. According to Binance’s incident report, as reported by Help Net Security, the attackers’ techniques included posing as a recruiter in a fake job interview with a software engineer.

The attack targeted staff, not customer verification, and AMLR customer due diligence does not cover it, but it shows that in crypto the question of who is on the other side applies to staff as much as to customers.

How should a CASP prepare for the AMLR?

Map where customers start relationships and where occasional transactions and linked transactions occur.
Offer qualifying eIDs and the EUDI Wallet first in the markets you serve, assess bank IDs separately, and use remote document checks as a justified fallback only where permitted.
Record which method verified each customer and, for alternative remote document checks, why the primary methods could not be used.
Check the data set against Article 22(1) of the AMLR, including the usual place of residence or, where permitted, a postal address.

A full self-assessment is in Are you ready for July 2027? A 32-question SCA & AMLR readiness checklist, and how identity platforms compare on AMLR requirements is covered in Best AML and KYC identity verification platforms.

Key AML terms are defined in the AML and KYC Glossary.

Authologic builds eID-native identity infrastructure that helps regulated businesses identify, onboard and authenticate their customers.

FAQ

Do CASPs have to verify customers for transactions below EUR 1,000?

Under Article 19(3)(b) of the AMLR, a CASP must at least identify the customer and verify the customer's identity for occasional transactions below EUR 1,000, whether carried out in a single operation or through linked transactions. CDD measures apply to occasional transactions of EUR 1,000 or more, when establishing a business relationship and whenever another Article 19 trigger applies.

Can a CASP onboard customers with the EUDI Wallet?

A CASP can use the EUDI Wallet to verify identity as part of onboarding; other CDD obligations still apply. The EUDI Wallet is an electronic identification means, and Article 22(6) of the AMLR recognises electronic identification means at assurance level substantial or high, as well as relevant qualified trust services, as routes to verify identity. Every Member State must provide at least one EUDI Wallet by 24 December 2026.